Overview

overview

10

Static

static

10

KAZZAK Nov...er.exe

windows7-x64

10

KAZZAK Nov...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    KAZZAKNova.rar

  • Size

    1.0MB

  • Sample

    250131-b7wefsxles

  • MD5

    e1d1ffda5b6298c0e50f24d1a802ff2c

  • SHA1

    2c37e889779eef7c795d5a32a640f68889a0d5ed

  • SHA256

    30adee2f7cba21cc4a48c262c26a34846c5f094182934402b6195da76b4b8f5e

  • SHA512

    2c36b9b79c7d763280568a3acf72d5e21c108a312a1e033393ab8546963da2113c2c3bb27ec3e01cbcd637b065f5d08b130c3c3516f98bfa4600a2cbfaa169b4

  • SSDEEP

    24576:Qc9pjbp14NUZqEqrN9532Wrzq5YJJiuEIAFx+60ztzSwliif5dw:PXpW6ZJqJn3ZrgiiD+60ztmwN5u

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

kaziahlds-23371.portmap.io:23371

Mutex

04d20254-5898-4b4a-8396-e1aacfd3225f

Attributes
  • encryption_key

    1127B18519097512D1F8F01C3CC393354B9F8404

  • install_name

    Loader.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    KAZZAK

  • subdirectory

    SubDir

Targets

    • Target

      KAZZAK Nova/KAZZAK Nova/Installer.exe

    • Size

      3.1MB

    • MD5

      c85c392d4f402f6d1efe69a397874fc8

    • SHA1

      d7bf20fc60a832f2c101fb47133fde314c164427

    • SHA256

      e33a67ca41bd7f1dbe94489e953d2a6d720dccd5fb82d62353946a193be862eb

    • SHA512

      605c12a4140fb1a18f76112040704c9c41a7b78b887324b12852400b56ab1c7e20d1587dfdc9ed62de1480eecaeb0e5b6f845157637aeecc429bdd60a068c971

    • SSDEEP

      49152:3vrI22SsaNYfdPBldt698dBcjHZTRJ6VbR3LoGdkTHHB72eh2NT:3vU22SsaNYfdPBldt6+dBcjHZTRJ6n

    Score
    10/10
    quasaroffice04spywaretrojandiscovery

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks